Directors must exercise personal judgement using AI

You must now demonstrate that any AI tool used to process board information remains subject to your personal review and critical judgement, and that this review is recorded and auditable. Delegation of the duty of care to a model output is not permitted, regardless of the tool's accuracy or the supplier's assurances.

The prompt is an analysis of 5 November 2026 of director liability when using AI to summarise board papers, which argues that AI may assist with board information but cannot replace a director's personal duty of care and critical questioning. The Federal Court of Australia in ASIC v Bekier ruled that a director who relies on an AI summary without their own assessment of the underlying material remains personally liable for decisions that follow. In our assessment, the ruling exposes a gap between the controls organisations put in place before deploying AI and the ongoing monitoring they maintain during use; formal, recorded policy is now a practical necessity rather than an optional governance layer.

Can a director use AI to process board papers at all?

The court's answer is conditional. AI may assist with navigating and summarising board information, provided its use is principled, transparent and does not replace the director's own reading and questioning. The ruling does not prohibit AI use; it prohibits outsourcing the duty of care to it. A director who works within an agreed framework, with clear boundaries on what the tool may touch and how its output is used, stands in a stronger position than one who deploys AI informally without recorded governance. The distinction matters because it determines what you can later show a court about how the decision was actually made.

What are the failure modes the ruling identifies?

• Substitution of summary for source material — relying on an AI output without reading the underlying board papers yourself.
• Absence of recorded policy — using AI tools on confidential information without a documented agreement on permitted uses and prohibited data.
• Approval without ongoing reassessment — treating pre-deployment sign-off as a permanent control when systems drift or supplier practices change.
• Unauditable decision pathways — making a decision that relied on an AI summary but being unable to show which source material, which human assessment and which approval step preceded it.
• Delegation of ethical judgement — treating a model's output as a substitute for the director's own weighing of competing interests or risks.

Which concrete controls must you be able to demonstrate?

1. Identify which board papers require your own reading of the source text — document which materials are too sensitive or material for AI summary alone, and ensure you read them yourself before any model output is used as an aid.
2. Record the policy governing AI use on board information — have your company secretary or legal counsel draw up a board policy before the next meeting cycle that names permitted uses, prohibited data, model and supplier choices, mandatory human approval and escalation routes.
3. Set up ongoing monitoring and reassessment of the AI system in use — do not treat pre-deployment approval as a permanent control; establish alert thresholds for drift, log changes to the model or supplier, and link this monitoring to the decisions that rely on it.
4. Document the decision pathway for each sensitive decision — for any material decision, be able to show which source material was consulted, which human assessment took place, and which approval step released the decision, rather than relying on the plausibility of the model's explanation.
5. Retain evidence of your critical review — keep records showing that you questioned the summary, checked it against the source, and exercised your own judgement before the decision was made.

How does the ruling change what "approval" now means?

Pre-deployment approval of an AI system or a supplier statement is no longer sufficient as a control during use. The court's emphasis on the director's permanent duty of care means that liability does not expire once a tool is approved. Organisations already deploying AI agents and third-party systems at scale often find that ongoing monitoring and reassessment lag behind the controls they put in place beforehand. This creates a governance gap: the tool was vetted once, but no one is watching whether its outputs remain reliable or whether the supplier's practices have changed. You cannot later defend a decision by pointing to an approval that happened months ago if you cannot also show that critical review took place during use.

What can tooling do, and what remains your own responsibility?

AI systems can help you navigate large volumes of board information, flag material points and organise material by topic or risk category. They cannot exercise your judgement about which risks matter most, which stakeholders' interests conflict, or how to weigh competing obligations. No tool can show a court that you actually read and thought about the material; only your own recorded assessment can do that. Formal governance frameworks and audit trails can make your compliance with the duty of care visible and defensible, but they cannot replace the act of thinking itself. The National Institute of Standards and Technology's AI Risk Management Framework offers good practice for structuring this separation between what the tool does and what you must do yourself, though it is voluntary and not binding on directors. What matters is that you can later demonstrate the difference between the model's work and your own.